Security: actualbudget/actual
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Disabled OpenID users keep access through existing session tokensGHSA-cq9c-6w48-qmfg published
Jun 12, 2026 by MatissJanisHigh -
CSV Formula Injection in Transaction Export via Imported Payee/Notes FieldsGHSA-xqjm-27pc-rvwm published
Jun 12, 2026 by MatissJanisModerate -
Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secretsGHSA-3f62-qv96-4p78 published
Jun 12, 2026 by MatissJanisModerate -
CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` HelperGHSA-7gh7-258j-4mpq published
Jun 12, 2026 by MatissJanisModerate -
Electron Run As Node in actualGHSA-7rvm-xjpp-63r9 published
Jun 5, 2026 by jfdomingModerate -
OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`GHSA-49v6-pqjq-xw55 published
May 26, 2026 by jfdomingHigh -
Shared users can perform owner-only file management actionsGHSA-23vm-ffgg-qvjr published
Jun 12, 2026 by MatissJanisHigh -
Path traversal vulnerability in actual-serverGHSA-4wf8-vhhr-4gpv published
May 26, 2026 by jfdomingModerate -
Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated ServersGHSA-prp4-2f49-fcgp published
Apr 23, 2026 by MatissJanisHigh -
Actual Sync Server 26.2.1 - Authenticated Path TraversalGHSA-27vg-33gh-4hwg published
Mar 7, 2026 by MatissJanisModerate